Reinforcing Compliance for the Paycheck Protection Program: What Recent Public and Political Developments Mean for Loan Recipients

Article effective based on date written: May 1, 2020

Takeaway:  Recently implemented rules, public statements of government officials, and the return of funds by some should not compel most businesses to change course; however, recipients of funds from the Paycheck Protection Program should collect and retain documentation to support certifications made with their loan applications, including both quantitative criteria and the necessity of the loan to maintain ongoing business operations in light of uncertainties caused by COVID-19.

Shortly after the creation of the Paycheck Protection Program (“the Program”), both the federal government and businesses acted quickly and, perhaps, without the normal care that would be exhibited when dealing with such large amounts of money.  On the one hand, the government did not have time to create significant procedural safeguards, or even establish regulations, prior to the issuance of much-needed funds.  On the other hand, businesses rightly perceived a limited timeframe to act in order to receive much-needed funds.  As could be expected, the initial funding for the Program was exhausted in a matter of days and those not applying within the first week were likely left out.

Subsequent reporting indicates that some businesses receiving funding were not necessarily the intended beneficiaries of the Program.  Other loans made under the Program were likely procured through misrepresentations and fraud.  In response, the government recently issued new rules and made several pronouncements in an attempt to eventually recover some of these funds through civil and criminal enforcement actions.  In light of these new rules and recent governmental statements, what is the potential exposure of businesses that received funding under the Program and how can this be minimized?  This article explores the background of the Program, certifications required for funding, public and legal reactions to perceived abuses of the Program, the prospects of future enforcement actions, and how businesses can minimize compliance risk and related enforcement.

Background on the Program.

As part of the CARES Act[1], which was signed into law on March 27, 2020, Congress initially authorized the release of $349 billion through the Program[2].  In concept, the Program authorizes the Small Business Administration (SBA) to guarantee loans made to small businesses with financial need resulting from the coronavirus.  Those qualifying for the Program can receive a loan of up to $10 million with an interest rate of only 1%.  Perhaps more importantly, the loan is entirely forgiven (and tax-free) if the proceeds are spent primarily on payroll costs during the specified period.

To broaden and expedite the reach of the Program, many requirements of typical SBA-backed loans were modified or eliminated.  Significantly, the Program waived a need for collateral, a need for personal guaranties, and the typical credit review process to qualify for the loans.  Loans could be approved without any government review and with only a few certifications made by a prospective borrower.  The Program also greatly expanded the definition of a qualifying borrower.  Each of these changes incentivized both borrowers and lenders to process applications for loans – potentially ones that should not have qualified in the first place – at a rapid rate.


Vague Certification Requirements. 

Although very little was required of prospective borrowers, they were still required to submit a two-page application, along with limited substantiating documents and certifications.  Aside from providing a few tax documents and payroll records, applicants are required to certify the following “in good faith”[3]:

  • The applicant was in operation on February 15, 2020 and paid salaries and payroll taxes or paid independent contractors;
  • Current economic uncertainty makes the loan request necessary to support ongoing operations;
  • Funds will be used to retain workers, maintain payroll and pay other specified expenses[4];
  • Documentation will be provided to verify the number of employees, the amounts of payroll costs, and other specified expenses incurred during the eight-week period following the loan;
  • Loan forgiveness will be based on documented payroll costs and other specified expenses, but that non-payroll costs may not be more than 25% of the total;
  • Between February 15, 2020 and December 31, 2020, the applicant will not receive another loan under the Program;
  • The information provided in the application and in all supporting documents and forms is true and accurate in all material respects;[5] and
  • The lender will confirm the eligible loan amount using required documents submitted and can share that information with the SBA for various purposes.

Some of these certifications specifically track the language of the CARES Act.  For example, in section 1102(a) of the CARES Act, it requires that an applicant certify “that the uncertainty of current economic conditions makes necessary the loan request to support the ongoing operations of the eligible recipient,” that the applicant acknowledge that “funds will be used to retain workers and maintain payroll or make mortgage payments, lease payments, and utility payments,” and that the applicant is not seeking multiple loans under the Program.  When the Program was first being administered, the SBA did not provide prospective borrowers with any further substantive guidance on the meaning of economic “uncertainty.”  The prevailing sentiment was that any business marginally affected by COVID-19 would qualify.


Public Backlash Towards Loan Recipients.

As a result of these lax eligibility standards, a vague requirement that “current economic uncertainty makes the loan request necessary to support ongoing operations,” and the near-immediate exhaustion of initial funding for the Program, public outcry quickly followed the disbursement of funds.  News outlets latched on to funding provided to larger companies that technically qualified for the Program but which potentially had access to other funding sources.  Shake Shack, AutoNation, Potbelly, and even the Los Angeles Lakers quickly became public targets when it was learned that they received significant funding and many smaller businesses had not.  Fearing further public scorn, each of these businesses returned all of the funding provided from the Program.  Still, there has been no apparent requirement for their return of the loans – e.g., that they were not eligible for the funding.  Instead, it appears that these maneuvers were likely only done to avoid further negative publicity.

At around the same time, additional rulemaking and public statements from the Secretary of the Treasury, Steven Mnuchin, underscored a need for certain businesses to return Program funds.  For instance, Mnuchin told CNBC on April 28, 2020 that the SBA would undertake a “full review” of any loan from the Program that exceeded $2 million.  This was an apparent response to loan recipients such as Shake Shack.  Going further, he indicated that “it was inappropriate for most of these companies to take the loans.  It was clear there was a certification.  We don’t think that they ever should have been allowed to.”  Mnuchin did not provide further detail on the basis for which these companies were not allowed Program funds or how they may have violated the certification requirements.

In that same vein, the Department of the Treasury later issued guidance indicating that hedge funds and private equity firms would not be eligible for Program funding as they are investment-based and speculative in nature and would otherwise be excluded from SBA funding.[6]   Portfolio companies of such firms could theoretically still qualify, but the guidance indicated that affiliation rules and “necessity” must be demonstrated.  Perhaps more importantly, within that same guidance, the Department of the Treasury created an administrative safe harbor with respect to certifications for loan proceeds.  For any borrower that applied for a loan prior to the issuance of the guidance and repaid the loan in full by May 7, 2020, they would be deemed by SBA to have made the required certification regarding “economic uncertainty” in good faith.[7]  In other words, if a business received funds and its eligibility was questionable, the SBA would not take enforcement action if the funds were immediately returned.  That safe harbor was created at the same time that the following guidance was issued[8]:


Question: Do businesses owned by large companies with adequate sources of liquidity to support the business’s ongoing operations qualify for a PPP loan?

Answer: In addition to reviewing applicable affiliation rules to determine eligibility, all borrowers must assess their economic need for a PPP loan under the standard established by the CARES Act and the PPP regulations at the time of the loan application.  Although the CARES Act suspends the ordinary requirement that borrowers must be unable to obtain credit elsewhere (as defined in section 3(h) of the Small Business Act), borrowers still must certify in good faith that their PPP loan request is necessary.  Specifically, before submitting a PPP application, all borrowers should review carefully the required certification that “[c]urrent economic uncertainty makes this loan request necessary to support the ongoing operations of the Applicant.”  Borrowers must make this certification in good faith, taking into account their current business activity and their ability to access other sources of liquidity sufficient to support their ongoing operations in a manner that is not significantly detrimental to the business.  For example, it is unlikely that a public company with substantial market value and access to capital markets will be able to make the required certification in good faith, and such a company should be prepared to demonstrate to SBA, upon request, the basis for its certification.  Lenders may rely on a borrower’s certification regarding the necessity of the loan request.  Any borrower that applied for a PPP loan prior to the issuance of this guidance and repays the loan in full by May 7, 2020.


Based on changing public sentiment towards the administration of the Program, the identity and relative financial strength of certain recipients of funds, and pronouncements from the Department of the Treasury and the SBA, some have suggested that those in receipt of funding are at risk of enforcement action if they did not strictly need funds from the Program, could have obtained credit elsewhere, and/or cannot prove that their financial position justified such government relief.


Enforcement Action Likelihood of Success.

While there are certainly some businesses that outright misrepresented facts in order to qualify for funding, it will likely be difficult for the government to succeed in any enforcement action predicated solely on perceived violation of the “necessity” certification.[9]  Absent other business considerations, those businesses that received funds and provided accurate information in the loan application process should not feel compelled to return Program funds, regardless of prevailing rhetoric.  Whereas discrepancies in objective measures for eligibility (such as payroll costs, number of employees, or expenses incurred) are obvious audit risks, the certification as to “necessity,” at least by itself, provides little basis for enforcement for a number of reasons.[10]

Guidance from the Program underscores the broad nature of the intended relief and the lack of objective standard needed to obtain funding.  Counter to the suggestions of some (i.e., that new guidance could result in enforcement action) the SBA indicates as follows within the same guidance[11]:

Question: I filed or approved a loan application based on the version of the PPP Interim Final Rule published on April 2, 2020. Do I need to take any action based on the updated guidance in these FAQs?

Answer: No. Borrowers and lenders may rely on the laws, rules, and guidance available at the time of the relevant application. However, borrowers whose previously submitted loan applications have not yet been processed may revise their applications based on clarifications reflected in these FAQs.

Read together with additions to the final interim rule, this guidance indicates that heightened considerations apply to borrowers certifying a need after April 28, 2020, but not necessarily before that date.  And despite the fear inspired by the return of funds by some companies and the creation of the safe harbor, this guidance underscores its limited effect.  Enforcement actions predicated on an unknown interpretation of “good faith need” and applied in a retroactive manner would most likely fall flat.  Moreover, applying a stringent standard to need would run afoul of specific language in the legislation requiring that a small business concern need not be able to obtain credit elsewhere.[12]  Bottom line: For those that complied with the express terms of the Program as of the date of their application and had any belief whatsoever that their business operations could be impacted by COVID-19, it will be difficult for government to succeed in a civil or criminal enforcement action.  Disproving an applicant’s good faith belief of potential necessity would be near impossible to prove without other indications of abuse.[13]


Mitigating Compliance Risks.

Even though governmental action would be difficult to support if an application was otherwise accurate and complete, businesses should still take steps to substantiate the facts and certifications contained within their loan application.  These steps will not only be useful in the event of an audit, but they may also be necessary to support a future application for loan forgiveness.  Further, even though it would be difficult for the government to penalize a business based purely on the “necessity” certification, businesses may be able to minimize the time, cost, and negative consequences of an audit or investigation if they are prepared to provide ample supporting information.  Although the supporting documentation will vary based on a specific set of facts and circumstances, some examples of substantiating information include, but are not limited to:

For the “Necessity” Certification

  • Documentation regarding the financial condition of the business (e.g., balance sheet, income statement, historical tax returns, payroll records, expense reports, etc.)
  • Projections regarding impact of COVID-19 on industry, business revenue and/or expenses (e.g., public pronouncements, industry guidance or whitepapers, internal projections, and reports on the potential impact of the pandemic and related shutdowns)
  • Documentation indicating recent/prior actual or possible financial difficulties of the business (e.g., reduction in accounts receivable, increase in accounts payable, reductions in incoming contracts, threatened litigation, outstanding debts and liens, information regarding prior attempts to access credit, etc.)
  • Information regarding consideration of financial needs (e.g., emails and internal correspondence regarding impact of COVID-19 on business, consultation with attorneys, accountants and other professionals, meeting minutes and similar documents discussing actions, documentation of reduction in force, etc.)


For Other Objective Eligibility Measures[14]

  • Existence as of February 15, 2020: copies of income tax returns, employment tax returns, other government filings (e.g., certificate of good standing, license applications), payroll statements, business correspondence, etc.
  • Pre- and Post-Application Payroll Costs:[15] copies of income tax returns, employment tax returns, payroll statements and related bank statements, insurance information and payments, documentation of retirement benefits and plan documentation, other human resources records (e.g., time sheets or punch cards, payment records, evaluations), wage and payment statements (e.g., Forms W-2, Form 1099, Schedule C, Schedule K-1, as applicable), payment of unemployment insurance, etc.
  • Size Eligibility[16]: copies of employment tax returns, income tax returns, combined wage and payment statements (Form W-3, summary of Forms 1099, etc.), other payroll records (if based upon alternative size requirement: copies of income tax returns, balance sheets, other annual financial reports)
  • Non-Payroll Expenses Eligible for Forgiveness: copies of bank statements showing payment of eligible expenses, mortgage agreement, mortgage statements and amortization schedules, rental agreement and related payments, invoices and remittance for utilities (e.g., phone, electric, gas, waters, transportation, or internet access)

Regardless of the nature of the audit or investigation, preparing and organizing substantial documentation for each of these requirements on the front-end will likely limit its scope, depth, and negative consequences to the business if selected for audit.  When performing such a compliance review or proactively preparing for an audit, businesses should also consider consulting with an attorney or accountant.  If this process is undertaken haphazardly, such preparation could produce errors, inconsistencies, or falsities in an application or certification that would later be subject to discovery by the government.  To this end, if there are any potential compliance weaknesses, a business should strongly consider consulting with an attorney to advise on potential options to proactively mitigate civil or criminal exposure.  Importantly, communications with an attorney will likely be subject to the attorney-client privilege and may not be used by the government in developing enforcement action against the business.  Accountants and other financial experts may not be subject to the same privilege as attorneys; however, they may provide invaluable assistance in collating important financial information for a possible audit as well.  If a business retains these professionals at the direction of an attorney, it is even possible to retain privilege with respect to their communications.

In sum, businesses that honestly and accurately completed applications for the Paycheck Protection Program and have already received funding should not feel the need to return these funds even in light of recent developments.  The same cannot be said for those that knowingly falsified objective criteria such as eligibility, ownership, amounts of payroll costs, and other items.  Regardless of potential legal liability, businesses receiving Program loans should proactively assemble documentation to support the various certifications and documents submitted with loan applications.  Given the upswell in public distrust of the Program, these steps will mitigate both the tangible and intangible costs that may arise if a business is selected for audit or investigation.

These descriptions are intended for informational purposes only and should not be taken as legal advice on any particular set of facts or circumstances.  Rosenberg Martin Greenberg, LLP is experienced in all aspects of federal and state tax laws, legislative developments concerning the CARES Act, addressing prior compliance issues, white collar criminal litigation, and more.  For more information, please contact Brandon Mourges at 410.951.1149 or


[1] Coronavirus Aid, Relief, and Economic Security Act, H.R. 748, 116th Congress (2020).

[2] The provisions of the CARES Act dealing with the Program are found in section 1102 and section 1106.

[3] A copy of the current loan application for the Program can be found at the following SBA website:

[4] The certification further notes that if the funds are “knowingly used for unauthorized purposes, the federal government may hold me legally liable, such as for charges of fraud.”

[5] The certification further states that: “knowingly making a false statement to obtain a guaranteed loan from SBA is punishable under the law, including under 18 USC 1001 and 3571 by imprisonment of not more than five years and/or a fine of up to $250,000; under 15 USC 645 by imprisonment of not more than two years and/or a fine of not more than $5,000; and, if submitted to a federally insured institution, under 18 USC 1014 by imprisonment of not more than thirty years and/or a fine of not more than $1,000,000.”

[6] Small Business Administration, Interim Final Rule (proposed April 28, 2020) (to be codified at 13 CFR pt. 120, 121 (available at:

[7] Id.

[8] Paycheck Protection Program Loans, Frequently Asked Questions (April 28, 2020) (available at:

[9] Some legal prognosticators indicate that erroneous certifications on loan applications could expose a business to liability under a number of criminal statutes involving falsehoods, such as 18 U.S.C. § 1001, 15 U.S.C. § 645, 18 U.S.C. § 1343, and others.  In addition, the civil False Claims Act (31 U.S.C. § 3729) has been identified as an enforcement mechanism.

While those statutes could apply to businesses falsifying or misrepresenting objective criteria in the application (e.g., size of business, payroll costs, etc.), an action based solely upon the “necessity” certification would fail in all but the rarest case.  In order to violate 18 U.S.C. § 1001, a person must (1) “falsify, conceal or cover up…a material fact, (2) “make[] any false, fictitious, or fraudulent statement[] or representation[]”, (3) “make[] or use[] any false writing or document knowing the same to contain any false, fictitious or fraudulent statement or entry,” and (4) the item must be material.  Department of Justice, Criminal Resource Manual at section 908 (available at: Further, any such false statement must be “knowingly and willfully” done, meaning it was made with “an intent to deceive” or “a design to induce belief in the falsity or to mislead.”  Id. at section 910.  To prove this standard, the government must show a defendant acted deliberately, with knowledge of falsity, or by demonstrating that the defendant “acted with a conscious purpose to avoid learning the truth” (i.e., reckless disregard).  Id.  Similar, if not heightened, standards apply with respect to other statutes requiring proof of fraudulent intent.  See id. at section 949 (indicating that other statutes referred to require not only proof of falsity, but also proof of fraudulent intent).  Similarly, with respect to the civil False Claims Act (31 U.S.C. § 3729), the government must prove that one submitted a false claim with knowledge of its falsity.  Proof of fraudulent intent is not required.  Knowledge can be based upon (1) actual knowledge, (2) deliberate ignorance of the truth or falsity of the information, or reckless disregard of the truth or falsity.

It is not clear how the government or any other civil litigant would be able to carry its burden without falsification of objective criteria on a Program application.  For instance, how could a party prove actual knowledge or reckless disregard of “current economic uncertainty” and a necessity “to support ongoing operations”?  Given the disparate and ever-changing levels of uncertainty caused by COVID-19, the vagueness of this standard, and the lack of any guidance in the legislation or from the agency, almost all cases would likely fail if based upon this certification alone.

[10] On the other hand, businesses that have falsified, misrepresented, or otherwise submitted inaccurate employee, payroll, or expense information, are at a higher risk.  These objective measures are likely capable of verification through documentation submitted in the loan origination and inconsistencies would provide a basis for civil or criminal enforcement measures.

[11] Paycheck Protection Program Loans, Frequently Asked Questions (April 28, 2020) (available at:

[12] The CARES Act specifically waives the “credit elsewhere” requirement typically required for SBA-guarantied loans.  For loan obtained pursuant to the Program, “the requirement that a small business concern is unable to obtain credit elsewhere, as defined in section 3(h), shall not apply to a covered loan.”  The waiver of this sometimes-arduous requirement underscores the legislative intent to benefit a broad base of companies, even those that may be able to access credit elsewhere.  Recent pronouncements indicating that access to credit may run afoul of the “necessity” certification may be of limited value in light of this provision.

[13] Many states were subject to some level of government-mandated shutdown in March 2020.  To date, in the six to eight weeks since those mandates became effective, numerous government officials, business pundits, and medical experts have indicated that varying levels of shutdown and related economic issues could persist for years.  These wide-ranging and unspecific projections have significantly improved since the time when most applications were filed in the Program and further underscore the uncertainty when funds were initially disbursed.  Based on information at the time, it would be hard to imagine that any business would fail the “necessity” standard.  Further, policy considerations counsel against such enforcement actions if based solely on a vague interpretation of “necessity, including perceived discrimination and government overreach, limited likelihood of success and effect on general deterrence, and a negative impact on future loan programs.

[14] Objective criteria for loan eligibility include size certification (e.g., number of employees in covered period, revenue, net assets), ownership and affiliation requirements, payroll costs from the pre-application period, and payroll costs and other eligible expenses incurred during the eight-week period following loan origination.

[15] Substantiation of post-application payroll costs are necessary to support loan forgiveness and to support an intent to use funding predominantly for payroll-related costs.

[16] Certain businesses should also retain information to confirm compliance with the ownership and affiliation rules, as of the time of application.